⚠️ Modernization Notice This post is based on notes I took in 2018 against Cisco IOS XE / ISG on the ASR 1000. The VRF placement rules and the MPLS-VPN restriction described here reflect the behavior I observed at the time. Treat the specifics as a record of what I tested, and validate against the current IOS XE ISG configuration guides before deploying. Background On the ASR 1000, ISG (Intelligent Services Gateway) handles subscriber web logon — the “captive portal” experience where an unauthenticated subscriber’s HTTP traffic is intercepted and redirected to a login or service-selection portal. Two ISG features work together to make this happen: ...

When running Cisco ASR1000 with ISG (Internet Services Gateway) or BNG (Broadband Network Gateway) functionality, bulk session state changes — particularly when many subscriber sessions drop and reconnect simultaneously — can cause session setup failures and CPU overload. Proper tuning of L2TP window sizing and call admission control prevents cascading failures. L2TP Congestion Avoidance When PPPoEoL2TP tunnels experience flaps (rapid up/down cycles), user sessions often fail to establish properly during the recovery phase. This is typically related to the L2TP window size (WS) parameter negotiated during tunnel setup. ...